CVE-2026-120310

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.109 Parse Server versions 9.0.0 through 9.10.6-alpha.1

Description Stored field values are returned in object update responses without verifying read access. This allows clients with class-level permissions or object Access Control Lists (ACLs) that permit updates but restrict reading to view object data. This can be exploited to read results from atomic operations such as Increment, Add, AddUnique, and Remove, as well as values set by Cloud Code triggers. Under certain conditions, using dot notation keys may allow the retrieval of the entire stored parent field.

Recommendations Update Parse Server to version 8.6.109 or later. Update Parse Server to version 9.10.6-alpha.1 or later.